Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe
-
Size
454KB
-
MD5
5e5624f7910825b71643e006a8818880
-
SHA1
6613de48d515c8a7f32e3b5d5db0628350083b32
-
SHA256
4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092
-
SHA512
e8d87a1c6e58cd293bf6d10fc9092eac50bc1c03441512aedd866a3a881d9b726841fcd23dd95b44ba15b263a02462259041780745f81a80d7646a72ed17efa5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2400-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-35-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2920-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-164-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1120-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-325-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-634-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2340-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-686-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1312-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-776-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2124 btntnt.exe 2748 llfrflf.exe 2360 jjvjv.exe 2920 fllrflx.exe 2596 3nhtbb.exe 2604 bbhhtt.exe 2328 pdvvd.exe 1144 nnbhth.exe 2628 pjvjp.exe 2524 5bthbb.exe 2420 jddjd.exe 2788 nhtnnb.exe 2916 jvdjv.exe 2608 ntthtb.exe 3064 jjvpd.exe 2460 1lrxffl.exe 376 hhntth.exe 1120 thbnbt.exe 1320 jjdpv.exe 1216 nhttbb.exe 772 vpjpd.exe 2876 bnhthn.exe 2228 jvjjd.exe 1732 3hthbn.exe 1072 1pvdd.exe 2312 ttntnt.exe 300 jjvjv.exe 2040 nhbtnt.exe 2292 hhnbhn.exe 2724 hnhthn.exe 2180 tttbnt.exe 1576 pjjpv.exe 2692 nnhntb.exe 2748 1dppd.exe 2832 xxxfxfx.exe 2676 bttbnt.exe 2728 9vpdv.exe 2616 xxrxffx.exe 3060 tntntt.exe 2080 tnnthn.exe 1948 7dppd.exe 2860 rrfrllf.exe 1780 3hbnbh.exe 2992 vvppv.exe 2160 1lrxxfl.exe 2112 tbbhbn.exe 2856 7btnhn.exe 2940 djjvj.exe 2924 xfxllrl.exe 2824 tnhtht.exe 2376 vdvpp.exe 2176 rllrxxl.exe 636 3rlffrf.exe 2308 bbbntb.exe 1280 vvppp.exe 956 3lffxfr.exe 2152 tthnhn.exe 2024 1jvvv.exe 2060 ppjvv.exe 2220 xrlxfrf.exe 1848 bhhtnh.exe 1524 7jjdj.exe 1944 vpjvj.exe 2476 rrlxrrf.exe -
resource yara_rule behavioral1/memory/2400-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-634-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2908-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-686-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1312-757-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2124 2400 4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe 30 PID 2400 wrote to memory of 2124 2400 4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe 30 PID 2400 wrote to memory of 2124 2400 4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe 30 PID 2400 wrote to memory of 2124 2400 4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe 30 PID 2124 wrote to memory of 2748 2124 btntnt.exe 31 PID 2124 wrote to memory of 2748 2124 btntnt.exe 31 PID 2124 wrote to memory of 2748 2124 btntnt.exe 31 PID 2124 wrote to memory of 2748 2124 btntnt.exe 31 PID 2748 wrote to memory of 2360 2748 llfrflf.exe 32 PID 2748 wrote to memory of 2360 2748 llfrflf.exe 32 PID 2748 wrote to memory of 2360 2748 llfrflf.exe 32 PID 2748 wrote to memory of 2360 2748 llfrflf.exe 32 PID 2360 wrote to memory of 2920 2360 jjvjv.exe 33 PID 2360 wrote to memory of 2920 2360 jjvjv.exe 33 PID 2360 wrote to memory of 2920 2360 jjvjv.exe 33 PID 2360 wrote to memory of 2920 2360 jjvjv.exe 33 PID 2920 wrote to memory of 2596 2920 fllrflx.exe 34 PID 2920 wrote to memory of 2596 2920 fllrflx.exe 34 PID 2920 wrote to memory of 2596 2920 fllrflx.exe 34 PID 2920 wrote to memory of 2596 2920 fllrflx.exe 34 PID 2596 wrote to memory of 2604 2596 3nhtbb.exe 35 PID 2596 wrote to memory of 2604 2596 3nhtbb.exe 35 PID 2596 wrote to memory of 2604 2596 3nhtbb.exe 35 PID 2596 wrote to memory of 2604 2596 3nhtbb.exe 35 PID 2604 wrote to memory of 2328 2604 bbhhtt.exe 36 PID 2604 wrote to memory of 2328 2604 bbhhtt.exe 36 PID 2604 wrote to memory of 2328 2604 bbhhtt.exe 36 PID 2604 wrote to memory of 2328 2604 bbhhtt.exe 36 PID 2328 wrote to memory of 1144 2328 pdvvd.exe 37 PID 2328 wrote to memory of 1144 2328 pdvvd.exe 37 PID 2328 wrote to memory of 1144 2328 pdvvd.exe 37 PID 2328 wrote to memory of 1144 2328 pdvvd.exe 37 PID 1144 wrote to memory of 2628 1144 nnbhth.exe 38 PID 1144 wrote to memory of 2628 1144 nnbhth.exe 38 PID 1144 wrote to memory of 2628 1144 nnbhth.exe 38 PID 1144 wrote to memory of 2628 1144 nnbhth.exe 38 PID 2628 wrote to memory of 2524 2628 pjvjp.exe 39 PID 2628 wrote to memory of 2524 2628 pjvjp.exe 39 PID 2628 wrote to memory of 2524 2628 pjvjp.exe 39 PID 2628 wrote to memory of 2524 2628 pjvjp.exe 39 PID 2524 wrote to memory of 2420 2524 5bthbb.exe 40 PID 2524 wrote to memory of 2420 2524 5bthbb.exe 40 PID 2524 wrote to memory of 2420 2524 5bthbb.exe 40 PID 2524 wrote to memory of 2420 2524 5bthbb.exe 40 PID 2420 wrote to memory of 2788 2420 jddjd.exe 41 PID 2420 wrote to memory of 2788 2420 jddjd.exe 41 PID 2420 wrote to memory of 2788 2420 jddjd.exe 41 PID 2420 wrote to memory of 2788 2420 jddjd.exe 41 PID 2788 wrote to memory of 2916 2788 nhtnnb.exe 42 PID 2788 wrote to memory of 2916 2788 nhtnnb.exe 42 PID 2788 wrote to memory of 2916 2788 nhtnnb.exe 42 PID 2788 wrote to memory of 2916 2788 nhtnnb.exe 42 PID 2916 wrote to memory of 2608 2916 jvdjv.exe 43 PID 2916 wrote to memory of 2608 2916 jvdjv.exe 43 PID 2916 wrote to memory of 2608 2916 jvdjv.exe 43 PID 2916 wrote to memory of 2608 2916 jvdjv.exe 43 PID 2608 wrote to memory of 3064 2608 ntthtb.exe 44 PID 2608 wrote to memory of 3064 2608 ntthtb.exe 44 PID 2608 wrote to memory of 3064 2608 ntthtb.exe 44 PID 2608 wrote to memory of 3064 2608 ntthtb.exe 44 PID 3064 wrote to memory of 2460 3064 jjvpd.exe 45 PID 3064 wrote to memory of 2460 3064 jjvpd.exe 45 PID 3064 wrote to memory of 2460 3064 jjvpd.exe 45 PID 3064 wrote to memory of 2460 3064 jjvpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe"C:\Users\Admin\AppData\Local\Temp\4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\btntnt.exec:\btntnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\llfrflf.exec:\llfrflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jjvjv.exec:\jjvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\fllrflx.exec:\fllrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\3nhtbb.exec:\3nhtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bbhhtt.exec:\bbhhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pdvvd.exec:\pdvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nnbhth.exec:\nnbhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\pjvjp.exec:\pjvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\5bthbb.exec:\5bthbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jddjd.exec:\jddjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nhtnnb.exec:\nhtnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jvdjv.exec:\jvdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ntthtb.exec:\ntthtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jjvpd.exec:\jjvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\1lrxffl.exec:\1lrxffl.exe17⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hhntth.exec:\hhntth.exe18⤵
- Executes dropped EXE
PID:376 -
\??\c:\thbnbt.exec:\thbnbt.exe19⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jjdpv.exec:\jjdpv.exe20⤵
- Executes dropped EXE
PID:1320 -
\??\c:\nhttbb.exec:\nhttbb.exe21⤵
- Executes dropped EXE
PID:1216 -
\??\c:\vpjpd.exec:\vpjpd.exe22⤵
- Executes dropped EXE
PID:772 -
\??\c:\bnhthn.exec:\bnhthn.exe23⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jvjjd.exec:\jvjjd.exe24⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3hthbn.exec:\3hthbn.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1pvdd.exec:\1pvdd.exe26⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ttntnt.exec:\ttntnt.exe27⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jjvjv.exec:\jjvjv.exe28⤵
- Executes dropped EXE
PID:300 -
\??\c:\nhbtnt.exec:\nhbtnt.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hhnbhn.exec:\hhnbhn.exe30⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hnhthn.exec:\hnhthn.exe31⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tttbnt.exec:\tttbnt.exe32⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjjpv.exec:\pjjpv.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nnhntb.exec:\nnhntb.exe34⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1dppd.exec:\1dppd.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe36⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bttbnt.exec:\bttbnt.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9vpdv.exec:\9vpdv.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xxrxffx.exec:\xxrxffx.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tntntt.exec:\tntntt.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tnnthn.exec:\tnnthn.exe41⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7dppd.exec:\7dppd.exe42⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rrfrllf.exec:\rrfrllf.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3hbnbh.exec:\3hbnbh.exe44⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vvppv.exec:\vvppv.exe45⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1lrxxfl.exec:\1lrxxfl.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tbbhbn.exec:\tbbhbn.exe47⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7btnhn.exec:\7btnhn.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\djjvj.exec:\djjvj.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xfxllrl.exec:\xfxllrl.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tnhtht.exec:\tnhtht.exe51⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vdvpp.exec:\vdvpp.exe52⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rllrxxl.exec:\rllrxxl.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3rlffrf.exec:\3rlffrf.exe54⤵
- Executes dropped EXE
PID:636 -
\??\c:\bbbntb.exec:\bbbntb.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vvppp.exec:\vvppp.exe56⤵
- Executes dropped EXE
PID:1280 -
\??\c:\3lffxfr.exec:\3lffxfr.exe57⤵
- Executes dropped EXE
PID:956 -
\??\c:\tthnhn.exec:\tthnhn.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\1jvvv.exec:\1jvvv.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ppjvv.exec:\ppjvv.exe60⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xrlxfrf.exec:\xrlxfrf.exe61⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bhhtnh.exec:\bhhtnh.exe62⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7jjdj.exec:\7jjdj.exe63⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vpjvj.exec:\vpjvj.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rrlxrrf.exec:\rrlxrrf.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tnttnn.exec:\tnttnn.exe66⤵PID:1988
-
\??\c:\pjdvd.exec:\pjdvd.exe67⤵PID:1076
-
\??\c:\flllfrl.exec:\flllfrl.exe68⤵PID:1628
-
\??\c:\hhbhbh.exec:\hhbhbh.exe69⤵PID:300
-
\??\c:\vpvdj.exec:\vpvdj.exe70⤵PID:1616
-
\??\c:\7rxrxxx.exec:\7rxrxxx.exe71⤵PID:1552
-
\??\c:\rxllrxx.exec:\rxllrxx.exe72⤵PID:1980
-
\??\c:\1bnbbh.exec:\1bnbbh.exe73⤵PID:2620
-
\??\c:\jjdvv.exec:\jjdvv.exe74⤵PID:2180
-
\??\c:\9lfrrxf.exec:\9lfrrxf.exe75⤵PID:2740
-
\??\c:\1lxxflx.exec:\1lxxflx.exe76⤵PID:2548
-
\??\c:\nhbntt.exec:\nhbntt.exe77⤵PID:2388
-
\??\c:\1jjjv.exec:\1jjjv.exe78⤵PID:2712
-
\??\c:\rrlflxl.exec:\rrlflxl.exe79⤵
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\1llrflr.exec:\1llrflr.exe80⤵PID:2560
-
\??\c:\5htbbh.exec:\5htbbh.exe81⤵PID:2660
-
\??\c:\1vpdp.exec:\1vpdp.exe82⤵PID:3056
-
\??\c:\9lxfffl.exec:\9lxfffl.exe83⤵PID:3052
-
\??\c:\bhtbnb.exec:\bhtbnb.exe84⤵PID:1772
-
\??\c:\btnthh.exec:\btnthh.exe85⤵PID:2072
-
\??\c:\jjdpv.exec:\jjdpv.exe86⤵PID:2908
-
\??\c:\rlxlffl.exec:\rlxlffl.exe87⤵PID:2340
-
\??\c:\hbthnn.exec:\hbthnn.exe88⤵PID:2520
-
\??\c:\5djjv.exec:\5djjv.exe89⤵PID:2872
-
\??\c:\5rxrrlr.exec:\5rxrrlr.exe90⤵PID:2904
-
\??\c:\bthntt.exec:\bthntt.exe91⤵PID:3068
-
\??\c:\1vjpp.exec:\1vjpp.exe92⤵PID:2820
-
\??\c:\3vjjp.exec:\3vjjp.exe93⤵PID:2528
-
\??\c:\xlxlrrr.exec:\xlxlrrr.exe94⤵PID:1348
-
\??\c:\1nhhnt.exec:\1nhhnt.exe95⤵PID:2348
-
\??\c:\tnbnhn.exec:\tnbnhn.exe96⤵PID:448
-
\??\c:\9jdjp.exec:\9jdjp.exe97⤵PID:2440
-
\??\c:\fxrrffr.exec:\fxrrffr.exe98⤵PID:2308
-
\??\c:\tthntt.exec:\tthntt.exe99⤵PID:2248
-
\??\c:\5vpdj.exec:\5vpdj.exe100⤵PID:1312
-
\??\c:\fxfflll.exec:\fxfflll.exe101⤵PID:1240
-
\??\c:\fxllxfl.exec:\fxllxfl.exe102⤵PID:1164
-
\??\c:\hbtthh.exec:\hbtthh.exe103⤵PID:2060
-
\??\c:\pddvd.exec:\pddvd.exe104⤵PID:2036
-
\??\c:\vpdjj.exec:\vpdjj.exe105⤵PID:1508
-
\??\c:\xrflllr.exec:\xrflllr.exe106⤵PID:644
-
\??\c:\3bntbb.exec:\3bntbb.exe107⤵PID:1944
-
\??\c:\vjvvj.exec:\vjvvj.exe108⤵
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\xlrxxxx.exec:\xlrxxxx.exe109⤵PID:764
-
\??\c:\ntbttt.exec:\ntbttt.exe110⤵PID:372
-
\??\c:\7ddvp.exec:\7ddvp.exe111⤵PID:816
-
\??\c:\djjdv.exec:\djjdv.exe112⤵PID:1784
-
\??\c:\7xlllll.exec:\7xlllll.exe113⤵PID:1740
-
\??\c:\thtnth.exec:\thtnth.exe114⤵PID:1676
-
\??\c:\ppdvd.exec:\ppdvd.exe115⤵PID:2648
-
\??\c:\jvdpp.exec:\jvdpp.exe116⤵PID:1688
-
\??\c:\7rfxxxx.exec:\7rfxxxx.exe117⤵PID:2804
-
\??\c:\ttnbbb.exec:\ttnbbb.exe118⤵PID:2736
-
\??\c:\btbhnn.exec:\btbhnn.exe119⤵PID:2844
-
\??\c:\9pjjp.exec:\9pjjp.exe120⤵PID:2768
-
\??\c:\lxllrrf.exec:\lxllrrf.exe121⤵PID:2652
-
\??\c:\bthtbt.exec:\bthtbt.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-